基于信息熵的分布式拒绝服务攻击协同检测系统的设计与实现.pdfVIP

基于信息熵的分布式拒绝服务攻击协同检 测系统的设计与实现 1) 1) 1) 1) 宋洪涛 王小峰 王勇军 常帅 1)(国防科学技术大学 计算机学院, 长沙 中国 410073) 摘 要 分布式拒绝服务（DDoS）攻击是一种近年来在网络上流行的能够导致巨大损失与破坏的拒绝服务攻击，攻 击方式正以多样化智能化快速发展。因此，DDoS 攻击检测是整个安全防范体系中的重要一环。只有快速、准确的识别 攻击，才能为安全防御提供有效的支撑。近年来，很多人或组织致力于 DDoS 检测的各种关键技术的研究中，也取得 了显著成果，但这些算法有些地方仍需要改进，本文以实时检测DDoS 作为目标，深入分析DDoS 的特征，对DDoS 攻击的检测技术进行了研究和现实分析，采取了基于信息熵的协同检测算法。在局部检测中对目的 IP 地址和源IP 地 址进行统计分析，采取子空间与K-means 算法相结合的方式估算信息熵，然后对检测信息及信息熵进行融合，采取全 局决策的方式来达到检测的目的，通过实验进一步验证了论文中所提出算法的优越性。 关键词 DDoS；信息熵；子空间；聚类算法；DHT ；chord The System of DDoS Attack Collaborative Detection Based on information entropy Design and Implementation SONG Hong Tao1), WANG Xiao Feng1), WANG Yong Jun 1), CHANG Shuai1) 1)( college of computer, National University of Defense Technology, Changsha 410073, China) Abstract Distributed denial of service(DDoS) is one of the denial of service attacks which are popular and leading to great economic loss and damage. The ways of attack are more diversified and intellectual. Therefore , the detection of DDoS attacks is an important stage in the whole security protection system, and it can provide effective support for security defense by identifying attacks quickly and accurately. These years, mansy people and organizations are engaged in research of all kins of key technologies of DDoS detection and hava got outstanding achievements. But the DDoS detection still need to be improved. With the aim of real-time detection of DDoS, the article makes a detailed analysis of characteristics of DDoS, research about detection technologies of DDoS and adapts c ollaborative detection based on information entropy. Do statistic analysis of destination ip address and source ip address in the partial inspection, by then method of subspace and K-means to estimate inform